Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.

HOWTO16 How to enable a Virtual Organisation on a EGI Federated Cloud

From EGIWiki
Jump to navigation Jump to search

Support a new Virtual Organisation in the EGI Federated Cloud

Support an already existing Virtual Organisation in the EGI Federated Cloud

Enable a Virtual Organisation on a EGI Federated Cloud site using OpenNebula

Enable a Virtual Organisation on a EGI Federated Cloud site using OpenStack

Assuming that you are using the Keystone VOMS module the steps needed are listed in the VOMS module documentation.

Keystone V2

The configuration for the Keystone V2 authentitaion is as follows:

  • Configure your LSC files according to the VOMS documentation
  • Create a tenant for your new VO:
$ keystone tenant-create --name <tenant_name> --description "Tenant for VO <vo>"
  • Add the mapping to your voms.json mapping. It must be proper JSON (you can check its correctness with online or with python -mjson.tool /etc/keystone/voms.json). Edit the file, and add an entry like this:
{
    "voname|FQAN": {
        "tenant": "tenant_name"
    }
}
  • Note that you can use the FQAN from the incoming proxy, so you can map a group within a VO into a tenant, like this:
{
    "dteam": {
        "tenant": "dteam"
    },
    "/dteam/NGI_IBERGRID": {
        "tenant": "dteam_ibergrid"
    }
}
  • Restart the Apache server, and it's done.